[RFC]: Proposal for Expanding Ignition with Cloud-Specific Configuration

Proposal for Expanding Ignition with Cloud-Specific Configuration

The majority of Azure VMs currently use cloud-init for VM provisioning. WALinuxAgent provisioning is being deprecated in favor of azure-init, and we are evaluating how best to support Flatcar and Fedora CoreOS. Upcoming changes to Azure Confidential VMs will encrypt custom data and sign user data, which is expected to break Ignition and prevent its use in CVM scenarios. Additionally, enabling Azure’s Metadata Security Protocol (MSP) requires Ignition to change how it fetches user data from IMDS due to the azure-proxy-agent requirement.

Azure-init can replace WALinuxAgent for tasks such as admin user creation, SSH key and password setup, and sshd configuration, but it does not address Ignition’s needs for accessing custom and user data.

This presents an opportunity to make Ignition a first-class provisioning agent on Azure, more closely aligned with cloud-init’s Azure datasource. Ignition’s ignition-fetch.service already overlaps with cloud-init’s local phase by mounting provisioning media and fetching instance metadata. The proposed --generate-cloud-config approach (see #2185) shows hows how cloud-specific behavior can be added by reusing Ignition’s existing configuration APIs as a clear, stable contract - similar to how Azure configuration is translated into cloud-init config. Afterburn does not address these gaps and is not well-suited as the contract surface for this functionality.

We can commit to bringing Ignition to parity with cloud-init on Azure and maintaining Azure-specific features, but this would expand Ignition’s scope. Community feedback is needed on whether this is acceptable. The fallback is to replace WALinuxAgent PA with azure-init and address Ignition’s limitations separately.

Start by reading the existing ignition-fetch.service behavior and the --generate-cloud-config proposal in #2185, then compare the stated Azure gaps with cloud-init’s Azure datasource. Done would require community agreement on whether Ignition should expand its scope and a defined contract for Azure-specific behavior; this RFC does not yet identify implementation files or tests.